Insufficient Access Event Type

Insufficient Access events contain details about errors relating to insufficient account, case, contact, and opportunity record access, so that you can troubleshoot and resolve access issues for your users.

The Insufficient Access event type is disabled by default. You can enable this event type for a period of 24 hours by contacting Salesforce Customer Support.

These insufficient access error scenarios are logged:

  • The user can’t share a case, contact, or opportunity because the user doesn’t have permission to share the parent account or the recipient of the share doesn’t currently have read access to the parent account.
  • The user can’t change ownership of a case, contact, or opportunity because the user doesn’t have permission to share the parent account or the new owner doesn’t currently have read access to the parent account.
  • The user can’t change the parent account of a case, contact, or opportunity because the user doesn’t have permission to share the new parent account or the owner of the case, contact, or opportunity doesn’t have read access to the new parent account.

Insufficient access errors resulting from bulk operations involving two or more records aren’t logged.

For details about event monitoring, see the Trailhead Event Monitoring module or REST API Developer’s Guide.

For more information on interpreting Insufficient Access events, see this knowledge article.

  • Type: String

  • Description: The type of insufficient access error that the user received.

  • Possible values:

    • DATA_NOT_AVAILABLE - The record is no longer accessible. For example, a record was deleted and moved to the Recycle Bin.
    • INVALID_TYPE - The record type doesn’t exist.
    • NO_ACCESS - The user doesn’t have the required access level to complete the attempted action on the record.

  • Example: NO_ACCESS

  • Type: Id
  • Description: The 15-character ID of the user who initiated the action that caused the insufficient access error. For example, a user attempts to transfer ownership of a record to a teammate, but the operation fails because the teammate doesn’t have the required access. In this scenario, the ACTUAL_LOGGED_IN_USER_ID is the user who attempted to transfer access, and the USER_ID is their teammate.
  • Example: 005XXXXXXXXXXXX
  • Type: String
  • Description: The object for which the user received the insufficient access error. Access errors for the account, case, contact, and opportunity objects are supported.
  • Example: Account
  • Type: String
  • Description: Description of the insufficient access error that the user received.
  • Example: User 005XXXXXXXXXXXX doesn’t have full access for the record 001XXXXXXXXXXXX.
  • Type: String
  • Description: The time in GMT that the insufficient access error occurred.
  • Example: 20130715233322.670
  • Type: String
  • Description: The type of event. The value is always InsufficientAccess.
  • Type: Id
  • Description: The 15-character ID of the organization.
  • Example: 00DXXXXXXXXXXXX
  • Type: String
  • Description: The ID of the record that the user doesn’t have access to.
  • Example: 001XXXXXXXXXXXX
  • Type: String
  • Description: The unique ID of a single transaction. A transaction can contain one or more events. Each event in a given transaction has the same REQUEST_ID.
  • Example: 3nWgxWbDKWWDIk0FKfF5DV

  • Type: String

  • Description: The access level required by the user’s attempted action on the record.

  • Possible values:

    • DELETE
    • FULL
    • READ
    • TRANSFER
    • WRITE

  • Example: FULL

  • Type: String
  • Description: The access time of Salesforce services in GMT.
  • Example: 20130715233322.670
  • Type: DateTime
  • Description: The access time of Salesforce services in ISO8601-compatible format (YYYY-MM-DDTHH:MM:SS.sssZ). The timezone is GMT.
  • Example: 2015-07-27T11:32:59.555Z
  • Type: Id
  • Description: The 15-character ID of the user for whom the insufficient access error occurred, either when the user couldn’t access a record, the user couldn’t complete an operation, or the user was the intended recipient of a record transfer that failed because the user didn’t have the required access.
  • Example: 005XXXXXXXXXXXX
  • Type: Id
  • Description: The 18-character case-insensitive ID of the user for whom the insufficient access error occurred, either when the user couldn’t access a record or the user was the intended recipient of a record transfer that wasn’t completed.
  • Example: 005XXXXXXXXXXXXIA0